File System Drivers (FSDs) manage file system formats. Although FSDs run in kernel mode, they differ in a number of ways from standard kernel-mode drivers. The most significant is that each FSD registers itself as a file system driver with the operating system. A filter driver that layers over a file system driver is called a file system filter driver. A file system filter driver includes the ability to view file system requests and optionally modify or complete the requests. File system filter drivers can include filter drivers for performing encryption, virus detection, and other operations.
Filename retrieval and formatting is commonly a large portion of the code implemented in a file system filter driver. File systems (e.g., NTFS, FAT, etc. . . . ) may vary in the size of filename that is allowed. For example, an NT file system sets the name specification such that each component in a file name path is limited to 255 characters and the total file name length is limited to 65536 characters. Filenames can contain Unicode characters as well as multiple periods and embedded spaces. However, certain file systems are limited to 8 (non-Unicode) characters for its filenames, followed by a period and a 3-character extension, commonly referred to as the “8.3” format. As a consequence, certain applications originally written for these files systems are still limited to understanding 8.3 format or compatible filenames. In other file systems, such as NTFS, the file system generates an alternate 8.3 format short name for a file created with a long name when the short name is requested by an application. A long name corresponds to filenames longer than the 8.3 format, those containing Unicode characters, those with multiple period characters or a beginning period, and those with embedded spaces. The short name is a fully functional alias for a file and is stored in the same directory as the long name. Either name may be used to open, read from, write to, or copy the file.
Other formats exist for filenames, and file system filter drivers may initiate queries for filenames in any one of these formats. Filenames are commonly used by file system filter drivers to control what action should be taken during I/O operations. A user or application can specify a filename in one of the many different formats. In certain cases, the file system filter driver normalizes the file name to a standard format to examine the filename for pertinence to its operations. File system filter drivers also commonly parse a filename into fragments. For example, a file system filter driver providing virus detection may be most interested in the type of extension of the filename (e.g., .exe, .dll, etc. . . . ), and wish to parse the extension from the filename. Currently, multiple filter drivers may attach themselves to one FSD, and each filter driver consumes resources by querying the FSD for the filename. Each file system filter driver includes code, and dedicates process time, to manage and manipulate filenames to achieve their functions.